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Drafted By: 


Case ID f : 3i 9T-HQ-A1487 667-CTD (U) COUNTERTERRORISM DIVISION 

242-HQ-C14812^1 (U) GUARDIAN THREAT TRACKING SYSTEM; 

GUARDIAN MANAGEMENT UNIT 


Synopsis: (U//FCUO) To clarify existing guidance regarding the 

required investigative steps for Guardian Assessnients . 

Details : 

Over the pa^t several years, the investigative steps undertaken during 
Guardian Assessment s have varied widely, especially in terms of 
databases /resources consulted and the manner in which those results 
were documented. In. order to standardize the investigative steps 
undertaken in Guardian Assessments, this EC contains a list of 
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i inv^e5tlg«tJ ve steps which must be under takeri, sr K^iaXmxm, 

Guardian Assessments . In particular, this EC focuses on 4i?^<tb«se^y 


^ which must be checked and the manner in which the resuits mu^t be 
w documented. 


The guidance contained herein conforms to the need to always cosdact 

'■i:i 

investigative activity using the •'least intrusive meens** if ofctainiftg 
Slij, information as required by Executive Order 12333, the Attorney 



r .. 


Ji General's Guidelines for Domestic FBI Investigations and the Domestic 


i 


Investigations and Operations Guide (DIOG) 


DATABASE /RESOURCE QUERIES 




EFFECTIVE IMMEDIATELY, EVERY GUARDIAN ASSESSMENT MOST INCLUDE, AT 


MINIMUM, SEARCHES OF THE FOLLONING DA TABASES/ RESOURCES : 


■■ HIT'' ' ‘ iKunilndti^f"-* 


in 


i. EBI/USIC Databases/Resources : 





piVS 


DNS 


NCIC 


iiiP® 





MICS 

Guardian (for deconf liction) 


^TIDE 




i 
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Telephone Applications 
Clearwater ■ ■■ - jr. 

"i'-Vj . . 

B a s e J umpe r ' 

DaLAS 

CTD/CIOS Net Talon Deconf liction Datatase 

CHS checks with the Field Office’s Confidential File Room CFRs 


2.iExternal LEO resources : 


Department of Motor Vehicles (States : DriTers Lieenae rnotps, eti 
Business filings (State) 


3 Open source resources; At the present tiire, the f o-l 
open source resources, at a mmiiEUffi, must be checked 

Assessments; however, this list will certainly evolve gcing rorwards 


V ‘'ferfa' ""-ih; 
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• Publicly available search engines, e.g. Google, Yahoo, Bing, etc* 
for queries of e-mail addresses, phone numbers, addresses, and ^ 
reverse lookups for e-mail addresses and phone numbers; I 

• Social media sites, e.g. YouTube, Facebook, Twitter, and Linkedln; 
® Web crawlers/deep web engines/social media searchers, e.g. 

Pipl.com, 2abaSearch.com, Spokeo.com, Spock.com, What s Public* Me, 
PeekYou.cora, and SocialSearching . inf o . 

• Photograph Web Sites, e.g. Flickr.com, PicasaWeb, and 
Shutter fly . com. 



il 


At the present time, checks of the following type of open source 
resource are suggested during Guardian Assessments: 



• Social Dashboards, e.g. Netvibes . com, Newspile.com, 

Addictomatic.com, Kurrently . com, Monitter.com, YourOpenBook.Org, 
and SocialSearching . Inf o . 

DOCDMENTING DATABASE /RESOURCE QUERIES 
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To document all database/resource queries, the substantive results of 
each query should be itemized in the Notes Section of the Guardian|i 
Assessment. The documentation for each query must contain the 

i 

substantive results of the q[uery, not just a conclusion that the 
results were positive. For example, results should be listed as 
follows ; 


DIVS - RESULTS LISTED 


SENTINEL - RESULTS LISTED 


FACEBOOK - RESULTS LISTED 


INTERVIEWS 


PRIOR TO CLOSING A GUARDIAN ASSESSMENT, AN INTERVIEW OF THE SUBJECT 
MUST BE CONDUCTED WHEN FEASIBLE. 





Subject interviews must be documented in an FD-302 in Sentinel, 
uploaded to the appropriate division assessment file, and attached to 
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the Guardian Incident jn the Attachmentg Se'itvon i r / > of 

non-aubjecta can be documented in the ^4otea '^^f^oLion of 
Incident. If interviewing a subiect la not feaaxj&je, f.oj 

not conducting a subject Interview must be docTBRente-i f Lht 5 

Section of the Guardian Asaesament . For example, an int’^ririew ;^^ll r. ^ 
be feasible if the subject is deceased or if a host nation his 
granted approval to interview an overseas subject. 

Section 5.9.1 of the DIOG indicates interviews 01 requests f-r 
information from public or private entities may be conducted ir, Typ^ ^ 
through 4 and Type 6 Assessments. Section 18 . 5 . 6.1 of the DIDG 
indicates ”an interview is the questioning of ar. indiyidual izo include 
a subject) in order to gather information that is certinent to and 
within the scope of an authorized Assessment or Predicated 
Investigation . " 

OTHER INVESTIGATIVE TECHNIQUES 

In addition to queries of databases/resource.s and interviews, careful 
consideration should also be given to utilizing other investigative 
methods authorized in Assessments, such as CHS tasking and physical 
surveillance, when appropriate. 


The point-of-contact for this matter is GMU Cnit Chief Bryan J. Htia.tn 
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